StatCan/aaw

Trivy: Retry scan on unexpected error

Closed this issue · 0 comments

Example
https://github.com/StatCan/aaw-kubeflow-containers/actions/runs/11187009289/job/31103235842#step:22:103


aquasecurity/trivy info installed /usr/local/bin/trivy
2024-10-09T19:11:20.280Z	INFO	Need to update DB
2024-10-09T19:11:20.280Z	INFO	DB Repository: ghcr.io/aquasecurity/trivy-db
2024-10-09T19:11:20.280Z	INFO	Downloading DB...
2024-10-09T19:11:20.437Z	FATAL	init error: DB error: failed to download vulnerability DB: OCI artifact error: OCI artifact error: OCI repository error: GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 78.409µs, allowed: 44000/minute
Error: Process completed with exit code 1.


Describe the solution you'd like

Some suggestions:

  • Retry on failure, parse error message to "TOOMANYREQUESTS"
  • Check for other Mirror (must be trusted)
  • Host local vuln db on acr, then expose to GH action

Describe alternatives you've considered

Additional context

aquasecurity/trivy-action#389